{"id":108554,"date":"2023-05-17T00:48:11","date_gmt":"2023-05-16T22:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=108554"},"modified":"2023-05-17T10:40:17","modified_gmt":"2023-05-17T08:40:17","slug":"ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","title":{"rendered":"PMFault r\u00fcnnak, mis suudab teatud serveris\u00fcsteemides CPU kahjustada","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Birmingham'i \u00fclikooli teadlased, kes on varem tuntud Plundervolt ja VoltPillager r\u00fcnnakute arendamise poolest, avastasid teatud serveri emaplaatides haavatavuse (CVE-2022-43309), mis v\u00f5imaldab f\u00fc\u00fcsiliselt CPU-d kahjustada selliselt, et seda ei saa taastada. Haavatavus, mille koodinimi on PMFault, v\u00f5ib olla kasutatud serverite kahjustamiseks, millele r\u00fcndajal puudub f\u00fc\u00fcsiline juurdep\u00e4\u00e4s, kuid on privileegitud juurdep\u00e4\u00e4s operatsioonis\u00fcsteemile, saadud n\u00e4iteks pahatahtliku haavatavuse \u00e4rakasutamise v\u00f5i administraatori mandaadi v\u00f5tete p\u00fc\u00fcdmise kaudu. <\/p>\n

Pakutud meetodi p\u00f5hiolemus seisneb PMBus-i liidese kasutamises, kus rakendatakse I2C protokolli, et suurendada protsessori t\u00e4iendavat pinget tasemeni, mis v\u00f5ib p\u00f5hjustada kiibi kahjustusi. PMBus-i liides tehakse tavaliselt VRM (Voltage Regulator Module) moodulis, millele p\u00e4\u00e4seb juurde BMC-kontrolleri kaudu toimuva manipulatsiooni kaudu. PMBus-i toetavate plaatide r\u00fcndamiseks on lisaks administraatori \u00f5igustele operatsioonis\u00fcsteemis vajalik ka programmiline juurdep\u00e4\u00e4s BMC-le (Baseboard Management Controller), n\u00e4iteks IPMI KCS (Keyboard Controller Style) liidese, Etherneti kaudu v\u00f5i BMC uuendamise kaudu k\u00e4imasolevast s\u00fcsteemist. <\/p>\n

Probleemi olemasolu, mis v\u00f5imaldab r\u00fcnnakut ilma autentimisseadete teadmiseta BMC-s, on kinnitatud Supermicro emaplaatidel, mis toetavad IPMI (X11, X12, H11 ja H12), samuti ASRocki emaplaatidel, kuid haavatavused v\u00f5ivad esineda ka muudel serveriplaatidel, millele on v\u00f5imalik p\u00e4\u00e4seda PMBus'i kaudu. Eksperimentide k\u00e4igus kahjustati nende emaplaatide t\u00f5ttu kahte Intel Xeon protsessorit, kui pinget t\u00f5steti 2.84 volti. BMC-sse p\u00e4\u00e4semiseks ilma autentimisseadete teadmiseta, kuid root-juurdep\u00e4\u00e4suga operatsioonis\u00fcsteemile, kasutati haavatavust lubade verifitseerimise mehhanismis, mis v\u00f5imaldas laadida BMC-kontrollerisse muudetud tarkvarauuenduse, samuti v\u00f5imalust mitteautentitud juurdep\u00e4\u00e4suks IPMI KCS kaudu. <\/p>\n

PMBus'i kaudu pinget muutmise meetodit saab kasutada ka Plundervolt'i r\u00fcnnaku teostamiseks, mis v\u00f5imaldab pinget v\u00e4hendades minimaalsetes suurustes kahjustada CPU andmeelementide sisu, mis on kasutusel Intel SGX'is isoleeritud anklavites ja p\u00f5hjustada algselt korrektsete algoritmide vigu. N\u00e4iteks, kui saavutada v\u00e4\u00e4rtuse muutmine, mida kasutatakse kr\u00fcpteerimise korrutamise protsessis, siis tulemuseks on vale kr\u00fcpteeritud tekst. Kui r\u00fcndajal on v\u00f5imalus p\u00f6\u00f6rduda SGX-i t\u00f6\u00f6tleja poole oma andmete kr\u00fcpteerimiseks, saab ta, p\u00f5hjustades t\u00f5rkeid, koguda statistikat muudetud kr\u00fcpteeritud teksti kohta v\u00e4ljundis ja taastada anklavis hoitava v\u00f5tme v\u00e4\u00e4rtuse. <\/p>\n

R\u00fcnnaku l\u00e4biviimise t\u00f6\u00f6riistad Supermicro ja ASRock plaatidele, samuti PMBus'i juurdep\u00e4\u00e4su kontrollimise utiliit on avaldatud GitHub'is.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PMFault, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108554","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PMFault r\u00fcnnak, mis v\u00f5imaldab m\u00f5nel serveri s\u00fcsteemil CPU v\u00e4lja l\u00fclitada | ProHoster","description":"Birmingham \u00fclikooli teadlased, kes on varem tuntud Plundervolt ja VoltPillager r\u00fcnnakute v\u00e4ljat\u00f6\u00f6tamise poolest, avastasid teatava n\u00f5rkuse (CVE-2022-43309) m\u00f5nedes serveri emaplaatides, mis v\u00f5imaldab f\u00fc\u00fcsiliselt rikke p\u00f5hjustada CPU-s, ilma v\u00f5imaluseta seda hiljem taastada. N\u00f5rkus, mille koodinimi on PMFault, v\u00f5ib olla kasutatud serverite kahjustamiseks, millele r\u00fcndajal ei ole f\u00fc\u00fcsilist juurdep\u00e4\u00e4su, kuid on privileeritud juurdep\u00e4\u00e4s operatsioonis\u00fcsteemile.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 PMFault, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PMFault, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-05-16T22:48:11+00:00","article:modified_time":"2023-05-17T08:40:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}